<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000066" bgcolor="#ffffff">
Luca,<br>
<br>
It does not prove anything as you are still using CP-provided client
right? CP-client will always understand CP firewall. I think it might
still use SecurID with secrificates. I do not know.<br>
Once you are able to connect with non-CP client, I will say yes, there
could be something wrong with openswan, but now....<br>
<br>
Cheers,<br>
<br>
Ondrej<br>
<br>
On 13.05.2010 18:16, Luca Arzeni wrote:
<blockquote
cite="mid:AANLkTim_KvcgRaiSF3Zq7Fwfw14gDaoOjYwrgY8P0B33@mail.gmail.com"
type="cite">
<pre wrap="">Alas,
administrator said that all people is now using certificates, and no
one is using securID, so I'm the (un)lucky guy.
I goggled around a little about ISAKMP_NEXT_N and found that
ISAKMP_NEXT_N is an always-welcome payload_type (Notification)
ISAKMP_NEXT_D is an always-welcome payload_type (Delete)
Now, I recall that I've read that, after a successfull connection, CP
sends some packets to see if connection is properly established. If I
could ignore them, and go ahead, probably the connection would
succeed...
What do you think about this? Do I need to patch openswan to reach this goal?
Thanks, Luca
On Thu, May 13, 2010 at 3:04 PM, Ondrej Valousek <a class="moz-txt-link-rfc2396E" href="mailto:webserv@s3group.cz"><webserv@s3group.cz></a> wrote:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">My wild guess is that the your Checkpoint only accepts SecurID clients and
not authentication using certificates.
</pre>
</blockquote>
<pre wrap="">Yes, that's probably it. At main mode, your CP responds with ISAKMP_NEXT_N
(which I do not know what it is) whereas it should respond with
ISAKMP_NEXT_KE (which is most likely Key Exchange request -Paul to
clarify...)
O.
</pre>
</blockquote>
</blockquote>
<br>
</body>
</html>